Public Transit Department Valley Metro Purchasing Cards June 20, 2018 Mission Statement To improve the quality of life in Phoenix through efficient delivery of outstanding public services. Report Highlights Prior Audit Recommendations All four prior audit recommendations that relate to credit card purchasing were implemented. Policies and Procedures The credit card transactions we tested were appropriate; however, some documentation exceptions were noted. In addition, we found that the use of cardholder agreements needed improvement. Project Team Ross Tate City Auditor Barbara Coppage Deputy City Auditor Greg Holmes Senior Internal Auditor Ryan Richelson Associate Auditor Project Number 1180059 This report can be made available in alternate format upon request. 140 N 3 rd Avenue Phoenix, AZ 85003 602-262-6641 (TTY use 7-1-1)
Executive Summary Purpose Our purpose was to determine that Valley Metro credit card controls were adequate to ensure compliance with policies and regulations. Background Valley Metro is the regional public transportation agency providing coordinated transit options to residents of the greater Phoenix area. Our scope included credit card transactions from May 2016 through January 2018. During this period, there were 25 active cardholders at Valley Metro who conducted 3,959 transactions totaling $1,304,233. Our audit testing covered four areas: 1) Prior credit card audit recommendations 2) Credit cardholder agreements 3) Credit card monitoring controls 4) Credit card transaction guidelines Valley Metro and Federal Results in Brief Prior audit recommendations related to credit card purchases were implemented. There were four recommendations tested for compliance. Three dealt with policy updates to improve controls over Chief Executive Officer (CEO) expenses, itemized receipts, and reconciliation of travel reports. The fourth required all cardholders to utilize the corporate account and follow organizational policy. Usage of the credit cardholder agreement needed improvement. While all current cardholders have a signed agreement, portions of our audit period lacked documented acknowledgement of policies, establishment of spending limits, and replacement or return of credit cards. Credit card usage monitoring was adequate according to Valley Metro policy, with one exception where charges occurred after the return of the credit card. The expenses noted in the exception were business-related. We recommended immediate cancellation of all returned credit cards to prevent further occurrences of this kind. Individual credit card transaction testing showed all sample transactions were appropriate; however, some exceptions were noted. Page 2
We found that all 100 transactions tested were for appropriate business use. However, some exceptions were noted for lack of itemized receipts and lack of approvals (meal pre-approvals, technology approvals, and approvals for purchases greater than $3,000). Page 3
Department Responses to Recommendations Rec. 2.1: Valley Metro Require all current cardholders to immediately sign the policy acknowledgement and compliance form when a new credit card policy is in effect. Response: Valley Metro concurs with the recommendation. No more than 10 business days prior to implementing a new credit card policy, all cardholders will receive training on the policy and will sign an acknowledgment form. After the effective date of the new policy, cardholders will not be permitted to use their card if the acknowledgment form has not been signed. Any new cardholders will receive the training and must sign the acknowledgment form prior to receiving the card for use. Target Date: Sept. 14, 2018 Explanation, Target Date > 90 Days: NA Rec. 2.2: Valley Metro Assure all cardholders have current single purchase and monthly spending limit documentation on file. Response: Valley Metro concurs with the recommendation. The Credit Card Administrator will annually review the documentation on file to ensure it is complete and has identified the appropriate single purchase and monthly limits. Target Date: Sept. 14, 2018 Explanation, Target Date > 90 Days: NA Rec. 2.3: Valley Metro Assure all appropriate approval signatures are completed for credit card limit changes, replacements, and returns. Response: Valley Metro concurs with the recommendation. The Credit Card Administrator will annually review the documentation on file to ensure it is complete and has the required approvals. Target Date: Sept. 14, 2018 Explanation, Target Date > 90 Days: NA Rec. 3.1: Valley Metro Require credit cards to be canceled immediately upon return. Response: Valley Metro concurs with the recommendation. The Credit Card Administrator, once a card has been returned, shall verify with the Controller that all pending charges have been processed and shall cancel the card within 5 business days of the card being returned. Target Date: Sept. 14, 2018 Explanation, Target Date > 90 Days: NA Page 4
Rec. 4.1: Valley Metro Expand monitoring role within the credit card policy to include review of: Submittal of itemized receipts Preapprovals for meals from Division Heads Approvals for technology purchases from the Chief Technology Officer Approvals for purchases greater than $3,000 from Division Head and Contracts and Procurement Response: Valley Metro concurs with the recommendation. Each cardholder s immediate supervisor will be responsible to ensure that proper documentation is included for each purchase, including any pre-approval forms for meals or travel with signatures. The Credit Card Administrator will verify that technology purchases have proper approval by the Division Head responsible for IT. The Credit Card Administrator will verify that purchases greater than $3,000 have the proper approvals from the Division Head and Contracts and Procurement. Target Date: Sept. 14, 2018 Explanation, Target Date > 90 Days: NA Page 5
1 Compliance with Prior Audit Recommendations Background We completed an audit of Valley Metro in April 2016 (Valley Metro Travel / Expenditure Audit 1160100), which reviewed staff-related expenditures for compliance with organizational policies, and assessed the adequacy of the financial control environment. As part of this audit, we assessed compliance with recommendations from the April 2016 audit pertaining to credit card purchases. There were four recommendations tested for compliance: 1) Recommendation 1.1: VMR and RPTA Boards update policy and/or employment agreements to reflect supervisory approvals necessary for CEO Monthly Expense Reports and credit card statements. 2) Recommendation 1.2: Valley Metro staff review and consistently apply agency policy related to itemized receipts for all purchases. 3) Recommendation 2.6: Valley Metro staff modify procedures to include a reconciliation of credit card expenditures to travel reports to ensure that all costs are captured, including conference registrations, miscellaneous airfare charges, and when necessary, foreign transaction fees, for transparency and accounting purposes. 4) Recommendation 5.7: Results Valley Metro executive staff ensure that all organizational employees utilize the corporate commercial credit card account and follow organizational policy. From a policy modification standpoint, Valley Metro implemented all the credit card related recommendations from the prior audit. Application of the new controls could be improved in the areas of itemized receipts and reconciliation of travel reports. Recommendations 1.1 and 1.2 were implemented. The policy was updated to require the Audit Finance Subcommittee Chair to review the CEO s credit card expenses, and to require itemized receipts for every purchase. Application of the policy could be improved regarding itemized receipts, as noted in Observation 4 of our detailed transaction testing. Recommendation 5.7 was implemented. All cardholders were on the same Wells Fargo account. Recommendation 2.6 was implemented from a policy standpoint, in that reconciliation of all travel related credit card expenses was required. However, application of the policy Page 6
could be improved. We tested the following transactions from May 2016 through January 2018: Travel Expenses Reconciled to Travel Report Description Amount % # Transactions % Credit Card Travel Expenses Identified $130,216 345 Travel Expenses Tested $43,912 141 Travel Expenses Reconciled $43,441 99% 130 92% Travel Expenses Not Reconciled $471 1% 11 8% 8% of transactions did not reconcile to the travel reports Recommendations None Page 7
2 Compliance with Valley Metro Credit Cardholder Agreement Background The Agency Credit Cardholder Agreement, Request and Change Form (CC Form), served several purposes: Acknowledgement that credit cardholders understand and will comply with the current Valley Metro Credit Card, Acceptable Use Policy Establishment of new cardholder single purchase and monthly spending limits Document changes in existing cardholder s individual purchase and monthly spending limits Document issuance of new credit cards to replace lost credit cards Document return of credit card that will no longer be used We tested compliance of the use of the CC Form from May 2016 through January 2018. Results All current credit cardholders have signed the CC Form acknowledging the current policy. However, there were gaps during our testing period when cardholders did not have a signed CC Form on file for months, some as long a year. The current credit card policy took effect in July 2016. Changes from the prior policy included additional approvals, oversight responsibilities, purchase preapprovals, and bank contact information. According to the policy, all cardholders should have signed a new CC Form acknowledging understanding of and compliance with the new policy; however, none did at that time. Eventually, all cardholders either had their spending limits adjusted, requiring them to sign the CC Form, or left Valley Metro employment. This accounted for 18 cardholders. The remaining 10 were new cardholders (from the time the policy was implemented) and had signed the CC Form upon receiving their credit card. Valley Metro inconsistently documented initial single and monthly purchase limits on the CC Form. All cardholders were required to have a CC Form documenting single and monthly purchase limits with the approval of the Division Head, Chief Financial Officer (CFO), and CEO. During our testing period, 28 cardholders were identified: 17 did not have documented and approved initial single purchase limits 14 did not have documented and approved monthly purchase limits Page 8
Monitoring controls did not consistently ensure that single and monthly purchase limits were not exceeded. We limited our testing to periods of time when cardholder spending limits were documented on the CC Form. Of the 17 cardholders with single purchase limits documented on the CC Form, one exception was noted, where a $4,840 purchase was made on a $3,000 limit. Of the 14 cardholders with monthly purchase limits documented on the CC Form, five exceptions were noted. Valley Metro inconsistently used the CC Form to change existing single or monthly purchase limits. There were 13 changes for either single or monthly purchase limits during our testing period. Nine occurrences had the proper approvals, the remaining four did not. Three of the CC Forms were missing the Division Head approval and one was missing the Audit and Finance Subcommittee Chair signature. All replacement credit card occurrences lacked proper usage of the CC Form. There were four replacement credit cards issued during our testing period. Three of the instances had no CC Form. One instance used the CC Form, but did not have the required CFO and CEO signatures. All returned credit card occurrences lacked proper usage of the CC Form. There were seven returned credit cards during our testing period. Four of the instances had no CC Form. Three instances used the CC Form, but did not have the required CFO and CEO signatures. Recommendations 2.1 Valley Metro Require all current cardholders to immediately sign the policy acknowledgement and compliance form when a new credit card policy is in effect. 2.2 Valley Metro Assure all cardholders have current single purchase and monthly spending limit documentation on file. 2.3 Valley Metro Assure all appropriate approval signatures are completed for credit card limit changes, replacements, and returns. Page 9
3 Monitoring of Credit Card Expenditures Background Monitoring of credit card transactions by Valley Metro was performed by four individuals/groups, as required by their Credit Card Policy. Their duties included: 1) Credit Card Administrator Coordinates and reviews the monthly Transaction Detail Report and approval process including, by not limited to, auditing a sample of transactions. 2) Division Heads Monitor and approve individual cardholder purchases. 3) Finance Division Reviews monthly credit card purchase approvals and billing statements, and ensures timely payment. Reviews and performs accounting transactions, and coordinates with Credit Card Administrator, Division Heads, Managers, and Cardholders to ensure accurate reconciliation of statement balances. 4) Chair, Audit and Finance Subcommittee Reviews and approves CEO s monthly activity and expenditures. We ensured monthly approvals were performed by each group from May 2016 through January 2018. Results Monthly approvals were performed by the Credit Card Administrator, Finance Division, and the Audit and Finance Subcommittee Chair during the audit period without exception. Division Head approvals were completed with one exception. The Credit Card Administrator, Finance Division, and the Audit and Finance Subcommittee Chair approval process occurs monthly. Testing was based on the Credit Card Administrator performing monthly sample audits, the Finance Division reconciling cardholder expenses to statement balances, and the Audit and Finance Subcommittee Chair approving CEO expenses. These monitoring duties were performed without exception during the 21 months tested. The Division Head testing was based on the review and approval of individual cardholder statements each month. This resulted in 315 tests over the 21 months. The one exception noted was the result of charges occurring after the return of a credit card. While the approximately $400 in charges were for legitimate purposes, they were not reviewed and approved by the Division Head. Recommendations 3.1 Valley Metro Require credit cards to be canceled immediately upon return. Page 10
4 Testing of Individual Transactions Background The testing of individual credit card transactions was required to comply with the Valley Metro Credit Card, Acceptable Use Policy. We tested the requirement that itemized receipts were submitted with all purchases. In addition, we tested the following three prohibited credit card purchase areas: 1) Business meals not pre-approved in writing by the responsible Division Head. 2) Single purchase exceeding $3,000 without written approvals from the Division Head and the Contracts and Procurement representative. 3) Technology purchases not approved by the Chief Technology Officer. In addition, since Valley Metro receives federal funds, we tested compliance with the Office of Management and Budget Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards (Uniform Guidance), which identifies allowable and unallowable expense areas. We tested a sample of transactions from May 2016 through January 2018. Results Valley Metro was inconsistent in obtaining pre-approval of meal purchases and in submitting itemized receipts. We identified 196 meals, totaling $43,496, and tested 50 (26%), totaling $12,448 (29%), for compliance with Valley Metro s policy. There were 27 meal purchases that did not have the required pre-approval. Three meal purchases had a summary receipt instead of the required itemized receipt. Valley Metro was inconsistent in complying with its credit card policy pertaining to high-dollar transactions (greater than $2,000). We identified 82 transactions greater than $2,000, totaling $200,881, and tested 50 (61%), totaling $123,969 (62%), for compliance with policy. Of the 50 tested, we found the following: 9 did not have itemized receipts. The receipts were either not itemized or were for a technology purchase where an advanced quote was used instead of the actual purchase price. 15 were for technology purchases; 14 were not preapproved by the Chief Technology Officer. 1 was greater than $3,000 and did not have written approval from the Division Head and Contracts and Procurement representative. Page 11
1 was for an additional meal purchase and did not have Division Head preapproval. All transactions tested complied with federal guidelines for allowable costs. Of the 82 high-dollar transactions, we tested 35 (43%), totaling $85,128 (42%), for allowability per federal guidelines, specifically the Uniform Guidance. Allowable transaction areas identified under the Uniform Guidance included: computing devices, conference costs, maintenance and repair, professional services, public relations, and rental costs. Some transactions were found to be unallowable, but no federal funds were used. Recommendations 4.1 Valley Metro Expand monitoring role within the credit card policy to include review of: Submittal of itemized receipts Preapprovals for meals from Division Heads Approvals for technology purchases from the Chief Technology Officer Approvals for purchases greater than $3,000 from Division Head and Contracts and Procurement Page 12
Scope, Methods, and Standards Scope We reviewed Valley Metro credit card purchases from May 2016 through January 2018. Methods We used the following methods to complete this audit: Reviewed Valley Metro credit card, procurement, and travel policies. Reviewed Office of Management and Budget Uniform Administrative Requirements, Cost Principles, and Audit Requirements for Federal Awards commonly known as Uniform Guidance. Tested compliance with prior audit recommendations related to credit card usage. Tested compliance with usage of Valley Metro s Agency Credit Cardholder Agreement, Request and Change Form. Tested compliance with credit card activity monitoring as required by the Valley Metro credit card policy. Tested a sample of credit card transactions to assure compliance with the Valley Metro credit card policy and federal guidelines. Unless otherwise stated in the report, all sampling in this audit was conducted using a judgmental methodology to maximize efficiency based on auditor knowledge of the population being tested. As such, sample results cannot be extrapolated to the entire population and are limited to a discussion of only those items reviewed. Standards We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the performance audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. We believe that the evidence obtained provides a reasonable basis for our findings and conclusions based on our audit objectives. Page 13